diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7b7af00..b954b37 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,12 +35,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           # with "autobuild", the analysis below runs the build itself
           build-mode: ${{ matrix.build-mode }}
-      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: /language:${{ matrix.language }}
           upload: ${{ inputs.upload }}
diff --git a/.github/workflows/stack-python.yml b/.github/workflows/stack-python.yml
index 4b3b33c..f3c041f 100644
--- a/.github/workflows/stack-python.yml
+++ b/.github/workflows/stack-python.yml
@@ -52,11 +52,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ matrix.python }}
       - if: inputs.manager == 'uv'
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
       - name: Install dependencies
         run: ${{ inputs.install-command }}
       - name: Run checks
diff --git a/.github/workflows/stack-ruby.yml b/.github/workflows/stack-ruby.yml
index abb44e7..4a2c81c 100644
--- a/.github/workflows/stack-ruby.yml
+++ b/.github/workflows/stack-ruby.yml
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+      - uses: ruby/setup-ruby@b1da4809b005e0178fe08a1d57317bffc00b7b4c # v1.332.0
         with:
           ruby-version: ${{ matrix.ruby }}
           working-directory: ${{ inputs.working-directory }}
diff --git a/src/version.ts b/src/version.ts
index bda7f79..7fe1b93 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -32,11 +32,11 @@ export const TOOL_VERSIONS = {
 export const ACTION_PINS = {
   checkout: { action: "actions/checkout", sha: "3d3c42e5aac5ba805825da76410c181273ba90b1", version: "v7.0.1" },
   setupNode: { action: "actions/setup-node", sha: "949feb2413d6458794dcd2491c4babbbce0c15c1", version: "v7.1.0" },
-  setupPython: { action: "actions/setup-python", sha: "5fda3b95a4ea91299a34e894583c3862153e4b97", version: "v7.0.0" },
+  setupPython: { action: "actions/setup-python", sha: "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0", version: "v7.1.0" },
   pypiPublish: {
     action: "pypa/gh-action-pypi-publish",
-    sha: "dc37677b2e1c63e2034f94d8a5b11f265b73ba33",
-    version: "v1.14.2",
+    sha: "7245906fb61fa33a13554f9d5fb856fe61758086",
+    version: "v1.14.3",
   },
 } as const;